A pseudo-random function is an efficiently-computable function which emulates a random oracle.

learn more… | top users | synonyms (1)

2
votes
1answer
349 views

Why is it important to generate a pseudorandom permutation from a pseudorandom function?

Most of the papers on block cipher constructions, especially the ones which discuss constructing block ciphers of arbitrary lengths or small domains, the techniques are designed based on building a ...
2
votes
0answers
62 views

Protocol/algorithms based on a variable-length input PRF

Are the proofs based on a PRF assumption still valid when using a variable-length input PRF ? The answer might be obvious, but I have a doubt.
2
votes
1answer
123 views

Is this EAX extension weakening the (provable) security of EAX?

I would like to insert a key deriving function into EAX mode, in order to hamper brute-force attacks for a key-size restricted cipher (56 bits). The modification inserts an identical multi-block ...
2
votes
1answer
162 views

The Goldreich-Goldwasser-Micali Construction with bad PRGS

I understand that if we have a secure PRG then the Goldreich-Goldwasser-Micali construction gives us a secure PRF. However, what I've not been able to find much material on is how will the GGM ...
5
votes
1answer
110 views

Is there any existing analysis for this construction to turn a tweakable blockcipher into a PRF?

I'm basically looking at this construction to turn a tweakable blockcipher $E_c(x)$ taking a key $k$, nonce $n$, counter $c$ (forming tweak $t = c||n$) and an input $x$ into a PRF on an ...
2
votes
2answers
1k views

Estimating bits of entropy

Best ways to estimate average bits of entropy in a byte stream. I know there are different statistical tests out there (NIST, Dieharder, etc), which all do different ways of analyzing entropy. What ...
3
votes
1answer
219 views

Salsa20 in Davies-Meyer mode with a fixed key (message): is it one-way?

Say I have a function that calculates a pseudo random permutation and this function is easy to invert. For example $P(i) = AES_k(i)$ where $k$ is a publicly known key. So anyone can compute $P(i)$ ...
1
vote
3answers
905 views

Hash function based on pseudorandom functions and security

Are there hash functions that make use of pseudorandom functions. Precisely, I'm looking for a specification of a hash function based on PRF (and based on the security of such a primitive).
1
vote
1answer
99 views

security amplification

Reading some papers on security amplification of weak-PRP written by Stefano Tessaro, I noticed the use of notion "epsilon-PRP" and the notion of "security amplification". These notions, in ...
-1
votes
1answer
109 views

Why is it said that if we know few bits of pseudo random sequence we can predict the whole of it?

I am new to this cryptography and in the source from which i study it is said that if we know the first few bits of a pseudo random sequence we can predict the whole of it.How is it possible? The ...
2
votes
2answers
198 views

Pseudorandom functions

The usual case to distinguish a pseudorandom function from a random function is to assume that the adversary can choose the plaintext blocks. Is there another case (game) in which the adversary can ...
1
vote
1answer
262 views

Encryption schemes and pseudorandom permutations

Can an encryption scheme (deterministic or not) be viewed as a pseudorandom permutation taking as input a message and returning a value of the same bit-encoding length ? Thank you.
3
votes
3answers
265 views

Construct a random permutation from a random function?

How can we construct a (pseudo) random permutation from a (pseudo) random function ? I've seen a method from Luby-Rackoff which allows to construct a PRP of length $2N$ from a PRF of input/output ...
2
votes
1answer
231 views

How does the birthday attack work in AUTH and UF-CMA games?

In the AUTH and UF-CMA games, an adversary is required to forge a ciphertext or message/tag pair to win the game. Given an encryption scheme $E$ and a PRF $F$, let $\hat{E} = C || F_k(C)$ and $C = ...
2
votes
1answer
840 views

Question about the definition of a secure PRF

I'm taking a cryptography introduction course, and we're covering the definition of a secure PRF. I understand the test goes as follows: A challenger picks a function $f$ such that $f \leftarrow ...
1
vote
1answer
80 views

Could use an explanation of the notation for an oracle adversary

In the definition below, what exactly does it mean for the adversary (not even sure that's the correct term?) to equal one? $$ \underset{K}{Pr} \left [A^{F_k(\cdot)} = 1 \right ] $$ Source (Page ...
1
vote
2answers
264 views

Generate random number which should depend on key

i want to generate random number for example from [1..100]. The algorithm which would generates random number should work similarly like a "Linear congruential generator", like this: $X_{n+1}≡(aX_n ...
2
votes
2answers
166 views

GGM PRG construction: Why do we need to change keys all the time with underlying PRG

When constructing a PRF that has n bit input using the GGM PRG, why do we always have to recursively run the PRG using its previous output as a seed key n times. Instead, why don't we run the PRG n ...
2
votes
1answer
270 views

What is an oracle adversary?

I'm trying to figure out block ciphers and this is the first time I've encountered the term "oracle adversary". It appears in the context of defining a PRP and a PRF. Can someone please explain what ...
10
votes
3answers
627 views

How to construct a good PRF from a block cipher?

We want to explicitly construct a good (as tentatively defined below) Pseudo-Random Function $F$ with $b$-bit input and output, from (preferably just) one Pseudo-Random Permutation $E$ of $b$-bit, as ...
3
votes
2answers
264 views

Proof that a function constructed from a PRP is, or is not a PRF?

Let $E$ be a family of Pseudo-Random Permutations of $b$ bits, with $E_K$ indistinguishable from random permutation with effort less than $O(2^b)$, easily computable as well as the inverse ...
0
votes
1answer
171 views

Pseudo-random Number generation for Passwords

I am looking for a good pseudo-random number generation algorithm for passwords. My scenario is that I have to generate 5K pseudo-random bits from a user-supplied password (6 characters). What are ...
1
vote
0answers
57 views

IND-CPA security scheme [duplicate]

Possible Duplicate: CPA Secure Chosen plaintext scheme The example for IND-CPA secure schemes given is generally: for a random r, $Enc_k(m) =(r|| E_k(r)$ $XOR$ $m)$ where $E$ is a $PRF$ ...
11
votes
2answers
5k views

What is difference between PRG, PRF, and PRP

Until what I have gotten is: A PRG is generator is a part of PRF that produces pseudo-random values for the function. PRF is semantically secure and has no worries of being invertible. Fine, then ...
6
votes
1answer
520 views

Goldreich-Goldwasser-Micali Construction

The Goldreich-Goldwasser-Micali construction allows to build a (cryptographically secure) pseudo-random function from of a (cryptographically secure) pseudo-random generator. More formally, let $G: ...
5
votes
2answers
282 views

Does a hash function in chaining mode or in counter mode make a better pseudo-random number generator?

I have two pseudorandom generators: $f_1$ takes a random seed $l_0||r_0$ $\in \{0,1\}^{160}$ as input and outputs $r_1||r_2|| \dots ||r_k$, where $l_i||r_i = \operatorname{SHA-1}(l_{i-1}||r_{i-1})$ ...
4
votes
2answers
820 views

Questions about Key Derivation Functions

My understanding is that a KDF is a function that takes a master secret and generates multiple keys. It is secure as long as the keys are "independent". If this is true, the following definition would ...
2
votes
1answer
250 views

Cryptographically strong pseudo-random seq. generators

If a pseudo-random sequence generator is built so that it uses an n-bit seed and outputs a string that is of length x. Let's say one wants to generate a bit string of length y and uses the previous ...
8
votes
1answer
4k views

Cryptographic security of PHP mt_rand() function using Mersenne Twister algo

At stackoverflow this question has been asked. It uses additional random entropy and a hash method (among others) to try and create a cryptographically secure pseudo-random number generator for PHP. ...
8
votes
1answer
557 views

Are there any authoritative definitions of “key stretching”?

This is mostly a terminology question, but I suppose that it is best asked and answered here. After browsing the Internet I have come across a fair number of completely different definitions of the ...
2
votes
3answers
318 views

Realize a MAC using a Pseudo-random function?

Given a pseudo-random function and assuming that we do not have any other tools, How can we construct a MAC? I believe this can be done. Would like to know if there is more than one way of doing ...